Install and configure sftp and chroot in the desired folder for archiving

For the safe transfer of archives over the Internet, I decided to always use SFTP. So I made an instruction in which we use the decision to OPENSSH.

The setup is made on Debian Squeeze, but it will also fit any *NIX system that you can put OPENSSH on.

Install the ssh command:

aptitude install ssh

Adding a user back Under which we will work with the archive folder:

useradd -d /dev/null -M -s /bin/bash back

Assign a password to the team created by the user - asks for a password 2 times, the input will not be displayed:

passwd back

I recommend writing your password in a notebook.

Create a folder in which the user can record archives:

mkdir -p /sftp/back/

Let's get the file rights :

chown -R back:back /sftp/back/

!!! ChrootDirectory It should not be available for recording to the user. back

Next, edit the configuration file. ssh downstream /etc/ssh/sshd_config

vi /etc/ssh/sshd_config

was:
...
Subsystem sftp /usr/lib/openssh/sftp-server

# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the ChallengeResponseAuthentication and
# PasswordAuthentication.  Depending on your PAM configuration,
# PAM authentication via ChallengeResponseAuthentication may bypass
# the setting of "PermitRootLogin without-password".
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
# and ChallengeResponseAuthentication to 'no'.
UsePAM yes
...

became:

...
#Subsystem sftp /usr/lib/openssh/sftp-server

# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the ChallengeResponseAuthentication and
# PasswordAuthentication.  Depending on your PAM configuration,
# PAM authentication via ChallengeResponseAuthentication may bypass
# the setting of "PermitRootLogin without-password".
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
# and ChallengeResponseAuthentication to 'no'.
#UsePAM yes

Subsystem      sftp    internal-sftp
Match User back
        X11Forwarding no
        AllowTcpForwarding no
        AllowAgentForwarding no
        ForceCommand internal-sftp
        ChrootDirectory /sftp/

Reboot the ssh command:

/etc/init.d/ssh restart

The task is completed, you can connect to the server on 22 ports (if it was not changed) under the login. back and the password you wrote down earlier.

I was with you. Sergey Lazarenko.